The value of many transactions depends crucially on their simultaneity. Indeed, simultaneity may be so important to certain financial transactions that entities often are willing, to incur great inconvenience and expense to achieve it. For example, consider the situation where two parties have negotiated an important contract that they now intend to "close." Often, the parties find it necessary to sign the document simultaneously, and thus they meet in the same place to watch each other's actions. Another example is the process of certified mail, where ideally the sender of a message desires that the recipient get the message simultaneously with the sender's obtaining a "receipt". A common certified mail procedure requires a person who delivers the mail to personally reach the recipient and obtain a signed acknowledgement when the message is delivered. This acknowledgement is then shipped to the sender. Again, this practice is costly and time consuming. Moreover, such acknowledgements do not indicate the content of the message.
In recent years, the cost, efficiency and convenience of many transactions have been improved tremendously by the availability of electronic networks, such as computer, telephone, fax, broadcasting and others. Yet more recently, digital signatures and public-key encryption have added much needed security to these electronic networks, making such communication channels particularly suitable for financial transactions. Nevertheless, while electronic communications provide speed, they do not address simultaneity.
The absence of simultaneity from electronic transactions severally limits electronic commerce. In particular, heretofore there has been no effective way of building so-called simultaneous electronic transactions ("SET's"). As used herein, a SET is an electronic transaction that is simultaneous at least in a "logically equivalent" way, namely it is guaranteed that certain actions will take place if and only if certain other actions take place. One desirable SET would be certified mail, however, the prior art has not addressed this problem effectively. This can be seen by the following consideration of a hypothetical example, called extended certified mail or "ECM".
In an ECM transaction, there is a sender, Alice, who wishes to deliver a given message to an intended recipient, Bob. This delivery should satisfy three main properties. First, if Bob refuses to receive the message (preferably before learning it), then Alice should not get any receipt. Second, if Bob wishes to receive the message, then he will receive it and Alice will get a receipt for the message. Third, Alice's receipt should not be "generic," but closely related to the message itself. Simultaneity is important in this transaction. For instance, Alice's message could be an electronic payment to Bob, and it is desired that she obtains a simultaneous receipt if possible.
Alice could try to get a receipt from Bob of a message m in the following way. Clearly, sending m to Bob in the clear as her first communication does not work. Should this message be her digital signature of an electronic payment, a malicious Bob may loose any interest in continuing the conversation so as to deprive Alice of her receipt. On the other hand, asking Bob to send first a "blind" receipt may not be acceptable to him.
Another alternative is that Alice first sends Bob an encryption of m. Second, Bob sends Alice his digital signature of this ciphertext as an "intermediate" receipt. Third, Alice sends him the decryption key. Fourth, Bob sends Alice a receipt for this key. Unfortunately, even this transaction is not secure, because Bob, after learning the message when receiving Alice's key, may refuse to send her any receipt. (On the other hand, one cannot consider Bob's signature of the encrypted message as a valid receipt, because Alice may never send him the decryption key.)
These problems do not disappear by simply adding a few more rounds of communication, typically consisting of "acknowledgements". Usually, such additional rounds make it more difficult to see where the lack of simultaneity lies, but they do not solve the problems.
Various cryptographic approaches exist in the literature that attempt to solve similar problems, but they are not satisfactory in many respects. Some of these methods applicable to multi-party scenarios propose use of verifiable secret sharing (see, for example, Chor et al), or multi-party protocols (as envisioned by Goldreich et al) for making simultaneous some specific transactions between parties. Unfortunately, these methods require a plurality of parties, the majority of which are honest. Thus, they do not envision simultaneous transactions involving only two parties. Indeed, if the majority of two parties are honest then both parties are honest, and thus simultaneity would not be a problem. Moreover, even in a multi-party situation, the complexity of these prior art methods and their amount and type of communication (typically, they use several rounds of broadcasting), make them generally impractical.
Sophisticated cryptographic transactions between just two parties have been developed but these also are not simultaneous. Indeed, if just two people send each other strings back and forth, and each one of them expects to compute his own result from this conversation, the first to obtain the desired result may stop all communications, thereby depriving the other of his or her result. Nonetheless, attempts at providing simultaneity for two-party transactions have been made, but by using assumptions or methods that are unsatisfactory in various ways.
For example, Blum describes transactions that include contract signing and extended certified mail and that relies on the two parties having roughly equal computing power or knowledge of algorithms. These assumptions, however, do not always hold and are hard to check or enforce anyway. In addition, others have discovered ways to attack this rather complex method. A similar approach to simultaneity has also been proposed by Even Goldreich and Lempel. In another Blum method for achieving simultaneous certified mail, Alice does not know whether she got a valid receipt. She must go to court to determine this, and this is undesirable as well.
A method of Luby et al allows two parties to exchange the decryption of two given ciphertexts in a special way, namely, for both parties the probability that one has to guess correctly the cleartext of the other is slowly increased towards 100%. This method, however, does not enable the parties to achieve guaranteed simultaneity if one party learns the cleartext of the other's ciphertext with absolute probability (e.g., by obtaining the decryption key); then he can deny the other a similar success.
For this reasons several researchers have tried to make simultaneous two-party transactions via the help of one or more external entities, often referred to as "centers", "servers" or "trustees", a notion that appears in a variety of cryptographic contexts (see, for instance, Needham and Schroder and Shamir). A method for simultaneous contract signing and other transactions involving one trustee (called a "judge") has been proposed by Ben-Or et al. Their method relies on an external entity only if one party acts dishonestly, but it does not provide guaranteed simultaneity. In that technique, an honest party is not guaranteed to have a signed contract, even with the help of the external entity. Ben-Or et al only guarantee that the probability that one party gets a signed contract while the other does not is small. The smaller this probability, the more the parties must exchange messages back and forth. In still another method, Rabin envisions transactions with the help of external party that is active at all times (even when no transaction is going on), but also this method does not provide guaranteed simultaneity.
The prior art also suggests abstractly that if one could construct a true simultaneous transaction (e.g., extended certified mail), then the solution thereto might also be useful for constructing other types of electronic transactions (e.g., contract signing). As noted above, however, the art lacks an adequate teaching of how to construct an adequate simultaneous transaction.
There has thus been a long-felt need in the art to overcome these and other problems associated with electronic transactions.